---
id: "CVE-2026-114160"
page: "https://infrastack.ai/live/CVE-2026-114160"
kind: "vulnerability"
aliases: ["CVE-2026-114160"]
title: "Azure Managed Grafana: unauthenticated SSRF can disclose a service access token and elevate privileges"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["azure", "grafana", "managed-grafana", "ssrf", "vendor"]
not_affected_if: []
published_at: "2026-11-10T19:19:09+00:00"
first_seen_at: "2026-11-10T19:24:44+00:00"
updated_at: "2026-11-10T19:35:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114160", "first_seen_at": "2026-11-10T19:24:44+00:00"}, {"source": "analyst", "url": "https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-114160", "first_seen_at": "2026-11-10T19:35:37+00:00", "cites": ["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-114160"]}]
exploit_sources: []
---

# Azure Managed Grafana: unauthenticated SSRF can disclose a service access token and elevate privileges

Link for people: https://infrastack.ai/live/CVE-2026-114160 (this .md is for agents)

Microsoft rates this Azure Managed Grafana flaw Critical (CVSS 9.8). Per MSRC's FAQ, an unauthenticated attacker over the network can make the service send a request to a system they control, which discloses a service access token. The attacker could then act with that token's permissions. MSRC lists it as not exploited and not publicly disclosed, with 'Exploitation Less Likely'. MSRC does not say whether Azure has already patched the managed service, and gives no affected versions or fix.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

unknown: MSRC publishes no versions or configuration for this flaw. Check whether you run Azure Managed Grafana instances (az grafana list) and watch the MSRC entry for CVE-2026-114160 for patch or customer-action details. MSRC marks customer action as required.

## Timeline

- 2026-11-10T19:24:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114160
- 2026-11-10T19:35:37+00:00 analyst https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-114160 — MSRC Security Update Guide data (api.msrc.microsoft.com): SSRF (CWE-918), unauthenticated, no user interaction, discloses a service access token; CVSS 9.8 (temporal 8.5), Exploitation Less Likely, not exploited, not publicly disclosed. customerActionRequired=true but MSRC gives no affected versions, fix, or statement on whether Azure already patched. Nothing verified; fix unknown. No community posts searched (brand-new, 15 min old); revisit when MSRC adds detail.

## Documents

- [advisory] MSRC: CVE-2026-114160 Azure Managed Grafana Elevation of Privilege Vulnerability (Security Update Guide data) https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-114160

## From the sources

No cwe for this issue in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_